Analysis
-
max time kernel
148s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
03-12-2024 10:17
Behavioral task
behavioral1
Sample
5b4a795046b247ce7fc0a9785614a2771e054f9d8d2950716f3ec2a00d167ae0.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
General
-
Target
5b4a795046b247ce7fc0a9785614a2771e054f9d8d2950716f3ec2a00d167ae0.exe
-
Size
3.7MB
-
MD5
72f767b1183d20c732f674bfe6bac75c
-
SHA1
28d3036ed2d8575e4a141f3ebad201aaf797fc5b
-
SHA256
5b4a795046b247ce7fc0a9785614a2771e054f9d8d2950716f3ec2a00d167ae0
-
SHA512
6008c0cbaeb1b3a2e1000280b49003d202b09ce64d397c7b0fcede4016573d353c0c030839db1ea58fb70a4391ac6905f30723a66f9b57973b90ede1cc3eab68
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98A:U6XLq/qPPslzKx/dJg1ErmNl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/1792-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-40-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2268-38-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/484-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-56-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2852-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1044-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1036-105-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2976-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-159-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2968-160-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/848-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/316-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1532-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/304-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1444-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/548-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1380-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1340-511-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-532-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2124-581-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-633-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1036-676-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1380-686-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-705-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-733-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1344-811-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1320-968-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1140-1044-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/380-1064-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1520-1101-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1720-1109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-1147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-1166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2636 266428.exe 2584 0808204.exe 2268 42246.exe 484 4042280.exe 2800 264024.exe 3036 1tbhbh.exe 2852 0882802.exe 2700 200264.exe 2548 bbbhbt.exe 1036 4240840.exe 1044 044242.exe 2976 02080.exe 1592 6024662.exe 2068 28200.exe 2960 lrfxfrx.exe 2968 86624.exe 3032 220868.exe 3024 400662.exe 1784 hbbbth.exe 2524 jpvdp.exe 848 frflfxl.exe 2128 228022.exe 1360 20428.exe 316 42680.exe 1532 248628.exe 1808 jjddd.exe 1520 ffxrxxl.exe 2168 2820806.exe 2376 6084440.exe 304 jvjjv.exe 1952 048460.exe 2316 ddpdd.exe 2576 bbtntn.exe 2624 448802.exe 1696 xxxxlrf.exe 1444 6684624.exe 548 vpjpj.exe 2812 flrrffl.exe 2936 6422402.exe 2988 60068.exe 1292 0242642.exe 2704 bnbhbh.exe 2696 lxxfrrx.exe 2760 ttbbbh.exe 2416 5rrflrx.exe 1812 7xxllrr.exe 1380 jvjpv.exe 2480 xxlfllx.exe 1256 nbtbbb.exe 2976 6204006.exe 2132 s6066.exe 2476 2084884.exe 1540 q28400.exe 1560 8864062.exe 2360 4062840.exe 1760 pjdvd.exe 3040 xrxrxxl.exe 2992 0424620.exe 1508 rrffllr.exe 2524 8240064.exe 2332 864402.exe 1496 4282822.exe 1192 3nhtbt.exe 2552 9vjpp.exe -
resource yara_rule behavioral1/memory/1792-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120fc-10.dat upx behavioral1/memory/1792-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1792-6-0x00000000002C0000-0x00000000002E7000-memory.dmp upx behavioral1/files/0x0007000000019551-19.dat upx behavioral1/memory/2636-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2584-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001955c-31.dat upx behavioral1/memory/2584-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2268-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000194da-41.dat upx behavioral1/memory/484-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000195c0-51.dat upx behavioral1/memory/2800-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000195f9-61.dat upx behavioral1/files/0x00060000000195fd-69.dat upx behavioral1/memory/2852-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000195ff-77.dat upx behavioral1/memory/2700-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b5-88.dat upx behavioral1/memory/2548-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b7-98.dat upx behavioral1/memory/2548-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1044-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b9-106.dat upx behavioral1/files/0x000500000001a4bb-116.dat upx behavioral1/memory/2976-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4bd-125.dat upx behavioral1/files/0x000500000001a4bf-133.dat upx behavioral1/files/0x000500000001a4c1-142.dat upx behavioral1/memory/2068-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4c3-152.dat upx behavioral1/memory/2960-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4c5-163.dat upx behavioral1/files/0x000500000001a4c7-171.dat upx behavioral1/files/0x000500000001a4c9-180.dat upx behavioral1/files/0x000500000001a4cb-187.dat upx behavioral1/files/0x000500000001a4cd-196.dat upx behavioral1/memory/848-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4cf-205.dat upx behavioral1/memory/2524-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4d1-213.dat upx behavioral1/memory/2128-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4d4-224.dat upx behavioral1/memory/316-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1532-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4d6-232.dat upx behavioral1/files/0x000500000001a4d8-243.dat upx behavioral1/memory/1532-241-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4da-251.dat upx behavioral1/files/0x000500000001a4dc-260.dat upx behavioral1/files/0x000500000001a4de-268.dat upx behavioral1/files/0x000500000001a4e1-276.dat upx behavioral1/memory/304-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4e3-284.dat upx behavioral1/files/0x000500000001a4e5-293.dat upx behavioral1/memory/1952-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2576-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1696-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1444-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1444-328-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/548-329-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-336-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-343-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8620284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8424680.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8400828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 868440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2606840.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 488800.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 428840.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8066280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22822.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 600246.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8860220.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2600246.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m6686.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6460206.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02648.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a0880.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0802062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 080864.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q66228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4644486.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5httbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 888800.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s2062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6846482.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0804402.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 884400.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4226684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q02406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6000402.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88426.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxfxfl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1792 wrote to memory of 2636 1792 5b4a795046b247ce7fc0a9785614a2771e054f9d8d2950716f3ec2a00d167ae0.exe 30 PID 1792 wrote to memory of 2636 1792 5b4a795046b247ce7fc0a9785614a2771e054f9d8d2950716f3ec2a00d167ae0.exe 30 PID 1792 wrote to memory of 2636 1792 5b4a795046b247ce7fc0a9785614a2771e054f9d8d2950716f3ec2a00d167ae0.exe 30 PID 1792 wrote to memory of 2636 1792 5b4a795046b247ce7fc0a9785614a2771e054f9d8d2950716f3ec2a00d167ae0.exe 30 PID 2636 wrote to memory of 2584 2636 266428.exe 31 PID 2636 wrote to memory of 2584 2636 266428.exe 31 PID 2636 wrote to memory of 2584 2636 266428.exe 31 PID 2636 wrote to memory of 2584 2636 266428.exe 31 PID 2584 wrote to memory of 2268 2584 0808204.exe 32 PID 2584 wrote to memory of 2268 2584 0808204.exe 32 PID 2584 wrote to memory of 2268 2584 0808204.exe 32 PID 2584 wrote to memory of 2268 2584 0808204.exe 32 PID 2268 wrote to memory of 484 2268 42246.exe 33 PID 2268 wrote to memory of 484 2268 42246.exe 33 PID 2268 wrote to memory of 484 2268 42246.exe 33 PID 2268 wrote to memory of 484 2268 42246.exe 33 PID 484 wrote to memory of 2800 484 4042280.exe 35 PID 484 wrote to memory of 2800 484 4042280.exe 35 PID 484 wrote to memory of 2800 484 4042280.exe 35 PID 484 wrote to memory of 2800 484 4042280.exe 35 PID 2800 wrote to memory of 3036 2800 264024.exe 36 PID 2800 wrote to memory of 3036 2800 264024.exe 36 PID 2800 wrote to memory of 3036 2800 264024.exe 36 PID 2800 wrote to memory of 3036 2800 264024.exe 36 PID 3036 wrote to memory of 2852 3036 1tbhbh.exe 37 PID 3036 wrote to memory of 2852 3036 1tbhbh.exe 37 PID 3036 wrote to memory of 2852 3036 1tbhbh.exe 37 PID 3036 wrote to memory of 2852 3036 1tbhbh.exe 37 PID 2852 wrote to memory of 2700 2852 0882802.exe 38 PID 2852 wrote to memory of 2700 2852 0882802.exe 38 PID 2852 wrote to memory of 2700 2852 0882802.exe 38 PID 2852 wrote to memory of 2700 2852 0882802.exe 38 PID 2700 wrote to memory of 2548 2700 200264.exe 39 PID 2700 wrote to memory of 2548 2700 200264.exe 39 PID 2700 wrote to memory of 2548 2700 200264.exe 39 PID 2700 wrote to memory of 2548 2700 200264.exe 39 PID 2548 wrote to memory of 1036 2548 bbbhbt.exe 40 PID 2548 wrote to memory of 1036 2548 bbbhbt.exe 40 PID 2548 wrote to memory of 1036 2548 bbbhbt.exe 40 PID 2548 wrote to memory of 1036 2548 bbbhbt.exe 40 PID 1036 wrote to memory of 1044 1036 4240840.exe 41 PID 1036 wrote to memory of 1044 1036 4240840.exe 41 PID 1036 wrote to memory of 1044 1036 4240840.exe 41 PID 1036 wrote to memory of 1044 1036 4240840.exe 41 PID 1044 wrote to memory of 2976 1044 044242.exe 42 PID 1044 wrote to memory of 2976 1044 044242.exe 42 PID 1044 wrote to memory of 2976 1044 044242.exe 42 PID 1044 wrote to memory of 2976 1044 044242.exe 42 PID 2976 wrote to memory of 1592 2976 02080.exe 43 PID 2976 wrote to memory of 1592 2976 02080.exe 43 PID 2976 wrote to memory of 1592 2976 02080.exe 43 PID 2976 wrote to memory of 1592 2976 02080.exe 43 PID 1592 wrote to memory of 2068 1592 6024662.exe 44 PID 1592 wrote to memory of 2068 1592 6024662.exe 44 PID 1592 wrote to memory of 2068 1592 6024662.exe 44 PID 1592 wrote to memory of 2068 1592 6024662.exe 44 PID 2068 wrote to memory of 2960 2068 28200.exe 45 PID 2068 wrote to memory of 2960 2068 28200.exe 45 PID 2068 wrote to memory of 2960 2068 28200.exe 45 PID 2068 wrote to memory of 2960 2068 28200.exe 45 PID 2960 wrote to memory of 2968 2960 lrfxfrx.exe 46 PID 2960 wrote to memory of 2968 2960 lrfxfrx.exe 46 PID 2960 wrote to memory of 2968 2960 lrfxfrx.exe 46 PID 2960 wrote to memory of 2968 2960 lrfxfrx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b4a795046b247ce7fc0a9785614a2771e054f9d8d2950716f3ec2a00d167ae0.exe"C:\Users\Admin\AppData\Local\Temp\5b4a795046b247ce7fc0a9785614a2771e054f9d8d2950716f3ec2a00d167ae0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\266428.exec:\266428.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\0808204.exec:\0808204.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\42246.exec:\42246.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\4042280.exec:\4042280.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\264024.exec:\264024.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\1tbhbh.exec:\1tbhbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\0882802.exec:\0882802.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\200264.exec:\200264.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\bbbhbt.exec:\bbbhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\4240840.exec:\4240840.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\044242.exec:\044242.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\02080.exec:\02080.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\6024662.exec:\6024662.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\28200.exec:\28200.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\lrfxfrx.exec:\lrfxfrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\86624.exec:\86624.exe17⤵
- Executes dropped EXE
PID:2968 -
\??\c:\220868.exec:\220868.exe18⤵
- Executes dropped EXE
PID:3032 -
\??\c:\400662.exec:\400662.exe19⤵
- Executes dropped EXE
PID:3024 -
\??\c:\hbbbth.exec:\hbbbth.exe20⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jpvdp.exec:\jpvdp.exe21⤵
- Executes dropped EXE
PID:2524 -
\??\c:\frflfxl.exec:\frflfxl.exe22⤵
- Executes dropped EXE
PID:848 -
\??\c:\228022.exec:\228022.exe23⤵
- Executes dropped EXE
PID:2128 -
\??\c:\20428.exec:\20428.exe24⤵
- Executes dropped EXE
PID:1360 -
\??\c:\42680.exec:\42680.exe25⤵
- Executes dropped EXE
PID:316 -
\??\c:\248628.exec:\248628.exe26⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jjddd.exec:\jjddd.exe27⤵
- Executes dropped EXE
PID:1808 -
\??\c:\ffxrxxl.exec:\ffxrxxl.exe28⤵
- Executes dropped EXE
PID:1520 -
\??\c:\2820806.exec:\2820806.exe29⤵
- Executes dropped EXE
PID:2168 -
\??\c:\6084440.exec:\6084440.exe30⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jvjjv.exec:\jvjjv.exe31⤵
- Executes dropped EXE
PID:304 -
\??\c:\048460.exec:\048460.exe32⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ddpdd.exec:\ddpdd.exe33⤵
- Executes dropped EXE
PID:2316 -
\??\c:\bbtntn.exec:\bbtntn.exe34⤵
- Executes dropped EXE
PID:2576 -
\??\c:\448802.exec:\448802.exe35⤵
- Executes dropped EXE
PID:2624 -
\??\c:\xxxxlrf.exec:\xxxxlrf.exe36⤵
- Executes dropped EXE
PID:1696 -
\??\c:\6684624.exec:\6684624.exe37⤵
- Executes dropped EXE
PID:1444 -
\??\c:\vpjpj.exec:\vpjpj.exe38⤵
- Executes dropped EXE
PID:548 -
\??\c:\flrrffl.exec:\flrrffl.exe39⤵
- Executes dropped EXE
PID:2812 -
\??\c:\6422402.exec:\6422402.exe40⤵
- Executes dropped EXE
PID:2936 -
\??\c:\60068.exec:\60068.exe41⤵
- Executes dropped EXE
PID:2988 -
\??\c:\0242642.exec:\0242642.exe42⤵
- Executes dropped EXE
PID:1292 -
\??\c:\bnbhbh.exec:\bnbhbh.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lxxfrrx.exec:\lxxfrrx.exe44⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ttbbbh.exec:\ttbbbh.exe45⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5rrflrx.exec:\5rrflrx.exe46⤵
- Executes dropped EXE
PID:2416 -
\??\c:\7xxllrr.exec:\7xxllrr.exe47⤵
- Executes dropped EXE
PID:1812 -
\??\c:\jvjpv.exec:\jvjpv.exe48⤵
- Executes dropped EXE
PID:1380 -
\??\c:\xxlfllx.exec:\xxlfllx.exe49⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nbtbbb.exec:\nbtbbb.exe50⤵
- Executes dropped EXE
PID:1256 -
\??\c:\6204006.exec:\6204006.exe51⤵
- Executes dropped EXE
PID:2976 -
\??\c:\s6066.exec:\s6066.exe52⤵
- Executes dropped EXE
PID:2132 -
\??\c:\2084884.exec:\2084884.exe53⤵
- Executes dropped EXE
PID:2476 -
\??\c:\q28400.exec:\q28400.exe54⤵
- Executes dropped EXE
PID:1540 -
\??\c:\8864062.exec:\8864062.exe55⤵
- Executes dropped EXE
PID:1560 -
\??\c:\4062840.exec:\4062840.exe56⤵
- Executes dropped EXE
PID:2360 -
\??\c:\pjdvd.exec:\pjdvd.exe57⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xrxrxxl.exec:\xrxrxxl.exe58⤵
- Executes dropped EXE
PID:3040 -
\??\c:\0424620.exec:\0424620.exe59⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rrffllr.exec:\rrffllr.exe60⤵
- Executes dropped EXE
PID:1508 -
\??\c:\8240064.exec:\8240064.exe61⤵
- Executes dropped EXE
PID:2524 -
\??\c:\864402.exec:\864402.exe62⤵
- Executes dropped EXE
PID:2332 -
\??\c:\4282822.exec:\4282822.exe63⤵
- Executes dropped EXE
PID:1496 -
\??\c:\3nhtbt.exec:\3nhtbt.exe64⤵
- Executes dropped EXE
PID:1192 -
\??\c:\9vjpp.exec:\9vjpp.exe65⤵
- Executes dropped EXE
PID:2552 -
\??\c:\frllxfx.exec:\frllxfx.exe66⤵PID:2640
-
\??\c:\84840.exec:\84840.exe67⤵PID:1340
-
\??\c:\80406.exec:\80406.exe68⤵PID:1344
-
\??\c:\xrrrlll.exec:\xrrrlll.exe69⤵PID:1492
-
\??\c:\3vppv.exec:\3vppv.exe70⤵PID:1856
-
\??\c:\0806020.exec:\0806020.exe71⤵PID:1252
-
\??\c:\4828828.exec:\4828828.exe72⤵PID:976
-
\??\c:\482240.exec:\482240.exe73⤵PID:1616
-
\??\c:\2662428.exec:\2662428.exe74⤵PID:304
-
\??\c:\6084628.exec:\6084628.exe75⤵PID:2620
-
\??\c:\tnhbtb.exec:\tnhbtb.exe76⤵PID:1916
-
\??\c:\nbhntt.exec:\nbhntt.exe77⤵PID:2124
-
\??\c:\ttttht.exec:\ttttht.exe78⤵PID:2596
-
\??\c:\8644000.exec:\8644000.exe79⤵PID:2636
-
\??\c:\9xflrxf.exec:\9xflrxf.exe80⤵PID:1696
-
\??\c:\btnnbn.exec:\btnnbn.exe81⤵PID:2764
-
\??\c:\bnhnhn.exec:\bnhnhn.exe82⤵PID:2268
-
\??\c:\m0406.exec:\m0406.exe83⤵PID:2900
-
\??\c:\40000.exec:\40000.exe84⤵PID:2212
-
\??\c:\3lrrrrr.exec:\3lrrrrr.exe85⤵PID:2892
-
\??\c:\6806224.exec:\6806224.exe86⤵PID:2984
-
\??\c:\rlxxffl.exec:\rlxxffl.exe87⤵PID:1324
-
\??\c:\i024660.exec:\i024660.exe88⤵PID:2756
-
\??\c:\ffxxllf.exec:\ffxxllf.exe89⤵PID:2728
-
\??\c:\bhtntb.exec:\bhtntb.exe90⤵PID:844
-
\??\c:\244628.exec:\244628.exe91⤵PID:1504
-
\??\c:\0462068.exec:\0462068.exe92⤵PID:1036
-
\??\c:\pjddj.exec:\pjddj.exe93⤵PID:1380
-
\??\c:\pjvjj.exec:\pjvjj.exe94⤵PID:1664
-
\??\c:\hthhhh.exec:\hthhhh.exe95⤵PID:2772
-
\??\c:\20468.exec:\20468.exe96⤵PID:2348
-
\??\c:\248406.exec:\248406.exe97⤵PID:2068
-
\??\c:\884400.exec:\884400.exe98⤵
- System Location Discovery: System Language Discovery
PID:2000 -
\??\c:\4484006.exec:\4484006.exe99⤵PID:1440
-
\??\c:\pjjpv.exec:\pjjpv.exe100⤵PID:2648
-
\??\c:\280228.exec:\280228.exe101⤵PID:3048
-
\??\c:\6280662.exec:\6280662.exe102⤵PID:2180
-
\??\c:\4488844.exec:\4488844.exe103⤵PID:2148
-
\??\c:\0442826.exec:\0442826.exe104⤵PID:1508
-
\??\c:\lflrrxf.exec:\lflrrxf.exe105⤵PID:980
-
\??\c:\a6068.exec:\a6068.exe106⤵PID:604
-
\??\c:\tnbhtn.exec:\tnbhtn.exe107⤵PID:2224
-
\??\c:\1hbttn.exec:\1hbttn.exe108⤵PID:1192
-
\??\c:\e20262.exec:\e20262.exe109⤵PID:1924
-
\??\c:\202080.exec:\202080.exe110⤵PID:1860
-
\??\c:\pddjv.exec:\pddjv.exe111⤵PID:2192
-
\??\c:\m6686.exec:\m6686.exe112⤵
- System Location Discovery: System Language Discovery
PID:1344 -
\??\c:\llxrfrf.exec:\llxrfrf.exe113⤵PID:2436
-
\??\c:\bhhbht.exec:\bhhbht.exe114⤵
- System Location Discovery: System Language Discovery
PID:1856 -
\??\c:\rrlflxf.exec:\rrlflxf.exe115⤵PID:1252
-
\??\c:\g4420.exec:\g4420.exe116⤵PID:1064
-
\??\c:\vjdpv.exec:\vjdpv.exe117⤵PID:1616
-
\??\c:\jvdvv.exec:\jvdvv.exe118⤵PID:304
-
\??\c:\fxffrxl.exec:\fxffrxl.exe119⤵PID:2400
-
\??\c:\86440.exec:\86440.exe120⤵
- System Location Discovery: System Language Discovery
PID:2060 -
\??\c:\rlxrxxr.exec:\rlxrxxr.exe121⤵PID:2608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-